This is the no-frills description for the stuff that really matters.
Tapo TC70 is pan-and-tilt (PTZ) camera.
TC70(EU) Ver 3.20 is sold as of Mid-2024 for 30 EUR in retail stores in Germany. This page is about this version. Earlier versions of the C200 used a Realtek SoC, completely different hardware.
"TC70 is basically the same model as the Tapo C200." It has only WLAN, no Ethernet. It comes with a note that GPL firmware is available. The file for "TC70 V3" links to https://static.tp-link.com/upload/gpl-code/2022/202211/20221130/c200v3_GPL.tar.bz2, note the "C200" in the filename.
Tapo C212 has Ethernet. It is not considerably more expensive, so probably the better deal. But its GPL firmware is not on the site.
1.4 watts in day mode, 2.2 watts in night mode. Night mode works extremely well even in total darkness. The camera can switch modes automatically, but one can also manually set the mode in the mobile app.
Apparently one needs their mobile app, which requires a tp-link account. The app connects to the device's WLAN SSID. Maybe the process could be reverse engineered to activate the camera without the need for a tp-link account, but the mobile app would still require it.
The mobile app for Android is ~200 MB in size. Why?
The camera communicates with a cloud service, because the mobile app can access the camera even if it is on another (e.g., mobile) network. This works without much hassle.
The cloud service can send push notifications to the mobile app if movement and/or people are detected. (This must cost the manufacturer money; wonder how long this will work.)
There is seemingly no way to disable the cloud service entirely. (Or is there?)
By default, there is 2FA active, which means that if you want to add a second mobile app, you need to verify a code on the first. This can be disabled in the account settings.
The status LED can be disabled (is green by default all the time, not only when someone is watching!), but it will blink red if the WLAN connection is broken.
Somewhat surprisingly, the mobile app always plays audio from the camera. There seems to be no video-only option. Optionally one can also speak to the camera, which is reasonably loud but seemingly at a fixed volume.
360p, 720p, 1080p. To reduce mobile bandwidth, 360p may be sufficient.
ONVIF is a standard over which PTZ cameras of various manufacturers can be controlled. In order to use it, it needs to be activated using the mobile app, and credentials need to be set.
Once activated, there is also an RTP stream available at rtsp://192.168.0.24:554/stream1, asking for the credentials set above. It works with VLC.
The Windows application "IP CENTCOM" successfully discovered the camera at 192.168.0.24:2020. The application also suggests to expose ONVIF port 2020 and RTSP port 554 via NAT for WAN access.
Apparently the camera only has IPv4 but not IPv6, which is a pity because it means that in order for WAN access, one needs a dyndns service or some VPN-like solution. (Would be nice if we could hack the camera firmware to run it there.)
https://www.onvif.org/wp-content/uploads/2016/12/ONVIF_WG-APG-Application_Programmers_Guide-1.pdf describes the ONVIF API.
$ nmap -p- 192.168.0.24
Starting Nmap 7.93 ( https://nmap.org ) at 2024-08-17 00:19 CEST
Nmap scan report for 192.168.0.24
Host is up (0.025s latency).
Not shown: 65530 closed tcp ports (conn-refused)
PORT STATE SERVICE
443/tcp open https # ???
554/tcp open rtsp # RTSP video streaming, works with VLC
2020/tcp open xinupageserver # Actually, ONVIF
8800/tcp open sunwebadmin # ONVIF event notifications? See https://gist.github.com/schauveau/c4ff736ae46f9d21527ef1eccee5baa1#port-8800
10123/tcp open unknown # ???
GPL Firmware package has ./c200v3_GPL/camera_slp/slp-sp-target-src/ingenict31/linux-3.10.14/, so we probably have an Ingenic T31 SOC of some sort.
./c200v3_GPL/camera_slp/torchlight/product_config/ALL/buildroot.config says OpenWrt version: Attitude Adjustment (r3039).
https://github.com/RX309Electronics/Tapo-C200V3-cam-research-project documents the innards of TC70(EU) Ver 3.20.
Note:
- Serial pins
- Unpopulated USB connector
The firmware files seem to be encrypted, as binwalk doesn't find anything.
Though different versions all seem to begin with
xxd Tapo_TC70v3_en_1.3.8_Build_230913_Rel.54885n_up_boot-signed_1695869685783.bin | more
00000000: 0000 0200 55aa 4c5e 831f 534b a1f8 f7c9 ....U.L^..SK....
00000010: 18df 8fbf 7da1 aa55 0800 0000 0000 0017 ....}..U........
- Original firmware dump of a C200 V3: https://github.com/RX309Electronics/Tapo-C200V3-cam-research-project/blob/main/Tapo-C200-V3-fwdump.bin
- Individual files from original firmware (likely different hardware model, but some binaries may be the same): https://github.com/ThinhinaneZeddam/Projet-Recherche/tree/main
- Old versions: https://github.com/tapo-firmware/Directory/blob/main/all_keys.txt
- Older versions of the similar C200v3: https://github.com/tapo-firmware/Tapo_C200/tree/main/Tapo_C200v3
https://thingino.com/ is a project for Open Source Firmware for Ingenic SoC IP Cameras. As of 8/2024, it does not support many Tapo cameras, yet.
One needs to find out the GPIOs to control the PTZ motors, the IR lights, and the SD enable pin. If one had root access to the stock device, one could possibly look them up by running mount -t debugfs none /sys/kernel/debug; cat /sys/kernel/debug/gpio.
So far, I have found this.
What can we learn in Open source from China? | Ingenic T31 MIPS/RISC DIY Embedded Linux